Ohio's Cybersecurity Rules for Local Public Bodies, in Plain English
Last verified: October 2026
Ohio now requires townships, villages, and other local public bodies to adopt a cybersecurity program, report incidents on a tight clock, and vote before paying any ransom. Here's what it means and how to comply. Want a hand? My number is (330) 200-8042.
Ohio's Public-Body Rules, at a Glance
Ohio's political-subdivision cybersecurity law (ORC 9.64, effective September 30, 2025) sets real expectations for counties, townships, villages, and many local public bodies. Your legislative authority must formally adopt a cybersecurity program; after an incident you must report to Ohio Homeland Security within 7 days and the Ohio Auditor of State within 30 days; and you may not pay a ransom unless the board formally votes to approve it. This guide explains it plainly and points to the free help available. There's a printable 29-page version up top. It's general information, not legal advice — confirm specifics with counsel and the Auditor of State.
Common Questions
1 Does ORC 9.64 apply to my small office?
If you're a political subdivision — a county, township, or village/municipality — you should assume it applies and confirm with your counsel. Size doesn't exempt you, but your program can be lean and built largely on free help. Schools should confirm their exact status.
2 What do we actually have to do?
Three things: your legislative authority adopts a written cybersecurity program; you report incidents on the required clocks; and you follow the ransom-payment rule. The program protects the availability, confidentiality, and integrity of your data and systems.
3 What are the reporting deadlines?
After a cybersecurity or ransomware incident, report to Ohio Homeland Security as soon as possible and no later than 7 days after discovery, and to the Ohio Auditor of State as soon as possible and no later than 30 days. Both clocks start at discovery.
4 Can we just pay a ransom to recover quickly?
Not on your own. A subdivision shall not pay unless its legislative authority formally approves it by resolution or ordinance stating why it's in the public's best interest. Build that vote into your incident plan ahead of time.
5 We have almost no budget — how do we comply?
Much of what you need is free: frameworks from NIST, scanning and guides from CISA, and training from CyberOhio. The main ask is time and a modest budget, and a lean, right-sized program still counts.
6 Where's the official guidance?
The Ohio Auditor of State issued guidance (Bulletin 2025-007) to help subdivisions comply, and is the office to confirm current specifics with. Because guidance can be updated, check with their office for the latest before you adopt or review your program.
Would You Rather I Just Help?
Small public offices are exactly who I love helping — stretched thin, tight budget, big responsibility. I'll help you turn on the protections, build a right-sized program leaning on free state and federal help, and get your reporting contacts ready so you can move fast if something happens. $99 flat for a visit, 30-day come-back-free. I'm a tech helper, not a lawyer — for the legal details I'll help you work with your counsel and the Auditor of State.
Would you rather I just do this for you?
No shame in it — plenty of folks would rather hand it off, and that's what I'm here for. I'll come to your home, set it up right, and make sure it's working before I leave. Flat $99 per visit — no jargon, no upsell, and every visit is 30-day come-back-free.
Not a hardware job? I can often fix it remotely for $49 — a secure screen-share, up to 2 hours, that you watch the whole time and can end whenever (included free for $39/mo Support Plan members, and it counts toward the $99 if it turns out I need to come out).